Add explicit unsigned Windows release mode

[dantraynor]

Summary

Signed Windows publication stays blocked until a signing provider and WINDOWS_EXPECTED_SIGNER_SUBJECT are recorded — but provider onboarding is still pending, and that gate currently blocks any release from carrying Windows assets at all.

This adds an explicit, opt-in unsigned mode: setting the WINDOWS_ALLOW_UNSIGNED_RELEASE repository variable to true ships the raw EXE and MSI without Authenticode signatures.

• package-windows stages the reviewed raw EXE and builds the MSI with -AllowUnsignedDevelopmentBuild instead of requiring a provider-signed helper; it records unsigned evidence carrying both final hashes.
• Defender environment validation and the controlled-runner scan are skipped; candidate assembly accepts the skipped scan only in unsigned mode and drops the Defender evidence expectation.
• Candidate metadata records windowsSigning: unsigned. Publication revalidates the mode, requires the same repository-variable consent at publish time, and skips only the signature/Defender evidence checks — the protected windows-release-clearance approval still gates publication, and all hash/byte-compare checks still run.
• Unsigned mode refuses to run while a signer subject is configured, so the modes cannot mix silently. With the variable unset, behavior is unchanged and fail-closed.
• Code-signing policy and release checklist record the interim exception; the variable comes out again once a provider is onboarded.

Testing

• actionlint v1.7.12 clean on both workflows.
• No change with the variable unset — default path identical to current main.